Nice tutorial, just not found of the authorization part, which "encourage" you to rely on http headers. Imho http headers are fine for a REST API, since the protocol depend on HTTP, but not for a GraphQL API since you can perfectly serve GraphQL behind something else, like Websocket, nats, or even direct TCP